pub fn rotation_health(vault: &Vault, now: DateTime<Utc>) -> Vec<RotationIssue>Expand description
Evaluate per-key rotation hygiene against now.
Reads only the plaintext schema, so it runs without decrypting the vault.
now is injected (rather than read from the clock) to keep this pure and
deterministically testable.